Lab — Diagnose a Broken Connection

Each rung answers one question. Loopback ICMP: can this kernel speak IP to itself? If no — stop; the ticket is the host, not the website. Gateway ICMP: can you reach the first hop on a network you own? If no — link, Wi-Fi, local firewall dropping ICMP, or a down CPE — not yet DNS. Name lookup: does getent/nslookup return an A or AAAA for a host you already use? If no — resolver, DHCP DNS option, or filtering of UDP/53 — not yet TLS. curl -I: do TCP and TLS complete, and what HTTP status returns? Timeout vs connection refused vs certificate error vs 200/301/403 are different diagnoses. If loopback works, gateway works, DNS works, and HTTPS works, you write "all rungs healthy" and you still record the commands. That file is how you will compare a future failure. If one rung fails, you do not keep "fixing" layers below a pass.

Isolation is a discipline: one hypothesis per command, one conclusion per rung. Jumping from "site won't load" to "disable ufw" mixes layers and destroys evidence. Jumping from a local timeout to nmap of the /24 leaves your authorized path and becomes unauthorized recon of other hosts. The ladder only needs your interfaces, your default via, your resolver, and one HTTPS URL you are allowed to request.

Gateway ping timed out does not always mean "LAN dead." Many home routers or host firewalls drop ICMP while TCP still works. Record ICMP-filtered if later HTTPS succeeds. Empty getent with curl "Could not resolve host" is DNS — not a missing certificate. Connection refused after a resolved IP is an open path to a closed port or a rejecting host. TLS errors after TCP connects are certificate or SNI problems — you already cleared IP and name. Write the symptom class in the conclusions block so next-week-you can trust the notes.

Healthy all-green runs still earn the mission. Paste the same commands next month when something breaks and compare. A baseline file with mode 600 is cheaper than guessing under pressure. Never "enrich" the notes by sweeping neighbors, classmates, or café devices — that is not diagnosis; it is unauthorized recon.

Create the lab directory if needed. Redirect command output into net-diag.txt, then add your own conclusion lines. Use the gateway IP that ip route prints — do not invent 192.168.1.1. If ping to the gateway is filtered, say so; do not call the LAN dead without the rest of the ladder. On Windows without ip/ss, use equivalent own-machine tools (ipconfig, ping 127.0.0.1, ping your default gateway, nslookup, curl -I) and save under Documents\cyberlium-lab — still your host only.

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/net-diag.txt"

{
  echo '=== Cyberlium net-diag (own machine only) ==='
  echo "date: $(date -Is 2>/dev/null || date)"
  echo

echo '--- 1) link ---'
  ip link
  echo

echo '--- 2) addr ---'
  ip addr
  echo

echo '--- 3) route ---'
  ip route
  echo

echo '--- 4) loopback ICMP ---'
  ping -c 4 127.0.0.1
  echo

echo '--- 5) gateway ICMP (edit GW from ip route; YOUR gateway only) ---'
  GW=$(ip route | awk '/^default/ {print $3; exit}')
  echo "parsed default via: ${GW:-NONE}"
  if [ -n "$GW" ]; then ping -c 3 "$GW"; else echo 'no default route — skip gateway ping'; fi
  echo

echo '--- 6) DNS (name you already use) ---'
  getent hosts example.com || true
  command -v nslookup >/dev/null && nslookup example.com || true
  echo

echo '--- 7) HTTPS headers ---'
  curl -I --connect-timeout 10 https://example.com || true
  echo

echo '--- conclusions (fill these) ---'
  echo 'loopback: PASS/FAIL —'
  echo 'gateway: PASS/FAIL/ICMP-filtered —'
  echo 'DNS: PASS/FAIL —'
  echo 'HTTPS: PASS/FAIL (timeout|refused|TLS|HTTP code) —'
  echo 'likely layer: link | IP | gateway | DNS | app/TLS | all healthy'
} > "$NOTES"

chmod 600 "$NOTES"

You practiced the only diagnosis that is always in scope: your stack, your first hop, your resolver, your HTTPS client — written down, mode 600. Healthy baselines count. Off-scope sweeps do not. Next — Quiz — Troubleshooting & Network Security — APPLY NAT, firewalls, and this layered order before Module 6 opens the LAN (switches, MAC, ARP, DHCP).